Kill-switch implementation

[JSONbored]

Context

#4809 (Kill-switch & incident runbook) bundles a well-specified engineering task — a tested mechanism to stop a misbehaving loop — with a written operational process (the incident runbook) that is a maintainer/ops responsibility, not an engineering one. Splitting lets the engineering half be contributor-eligible; #4809 itself now covers the runbook only.

Dependencies

Blocked on #4782 (Third-party autonomy & security governance spec) being approved — it defines what state a loop must be left in when the kill-switch is pulled.

Requirements

1. Implement the kill-switch mechanism defined by Third-party autonomy & security governance spec #4782's governance spec: a way to stop a running rented loop reliably.
2. The kill-switch must work regardless of which step of the loop is currently executing.
3. Leave the loop in the state Third-party autonomy & security governance spec #4782 specifies once triggered.
4. Out of scope: the written incident runbook — that remains Incident runbook for the kill-switch #4809's own scope.

Deliverables / Acceptance Criteria

• A working kill-switch that halts a running loop
• A live drill: triggering the kill-switch on a test loop stops it and leaves it in the state Third-party autonomy & security governance spec #4782 specifies
• The kill-switch works from every step of the loop, not just between iterations

Test Coverage Requirements

This PR must ship with full test coverage for every changed line and branch — the repo's Codecov patch gate requires 99%+ coverage. Cover both the "triggered mid-iteration" and "triggered between iterations" branches, and the resulting state in each case.

Expected Outcome

A misbehaving rented loop can be reliably stopped, closing the engineering half of the safety gap #4809 originally covered end to end.

Links & Resources

• Third-party autonomy & security governance spec #4782 (governance spec this implements)
• Incident runbook for the kill-switch #4809 (the issue this splits from — now covers the incident runbook only)

[linear-code]

JSO-3884